Refer to the exhibit. Which statement is correct regarding the event displayed?

The correct answer is B. The security risk was blocked or dropped. The security event risk is not mitigated or contained, so it is considered open. Example: an IPS/AV log with action=pass will have the event status Unhandled. Botnet and IoC events are also considered Unhandled. The risk source is isolated. Example: an AV log with…

Event Management

Question

Exhibit

Options

AThe security event risk is considered open.
BThe security risk was blocked or dropped.
CThe risk source is isolated.
DAn incident was created from this event.

How the community answered

(26 responses)

A
4% (1)
B
81% (21)
C
12% (3)
D
4% (1)

Explanation

The security event risk is not mitigated or contained, so it is considered open. Example: an IPS/AV log with action=pass will have the event status Unhandled. Botnet and IoC events are also considered Unhandled. The risk source is isolated. Example: an AV log with action=quarantine will have the event status Contained. The security risk is mitigated by being blocked or dropped. Example: an IPS/AV log with action=block/drop will have the event status Mitigated. (Blank) Other scenarios.

Topics

#event status#security events#risk indicators#blocked traffic

Community Discussion

No community discussion yet for this question.

Full NSE5_FAZ-7.2 Practice